Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Gmail tells me that it was recently accessed by IP address, and that it blocked the suspicious access, and I should change my password immediately. But is a reserved IP address according to IANA. It's not registered with RIPE, ARIN, AfriNIC, LACNIC or APNIC. So... How can this be? How could someone even use such an IP address in the first place, and try to access my Gmail account of all things?

All registries report the IP address as "reserved", and ARIN shows it as being owned by IANA. This is the description I found about the - range:

This block, formerly known as the Class E address space, is reserved for future use. The one exception to this is the "limited broadcast" destination address As documented in the Standards RFC 919 and RFC 922, packets with this destination address are not forwarded at the IP layer. This block was reserved by the IETF in the Standard document, RFC 1112 and is further documented in the Best Current Practice document RFC 5735.

share|improve this question
up vote 12 down vote accepted

I'm the Gmail Community Manager. I spoke with our team about what you described.

What you are seeing is a bug in our system related to the use of IPv6. Very specific types of logins to do with mobile phone syncing that come in over IPv6 are not currently treated correctly. We're in the process of fixing this issue and I apologize for the inconvenience.

share|improve this answer
four years later, and I've just heard another report of this exact bug... – Alnitak Jul 11 at 17:48

Someone seems to have faked the IP address and tried to access your account. That can be the only explanation as any traffic from that IP address is kind of impossible.

Good that you changed password, also turn on two-step authentication if you haven't already.

Edit: Found this question at Gmail support forum. They said the same thing.

share|improve this answer
But what purpose would it serve to fake the IP? If the attacker uses an impossible IP, how can he find out if the attack succeeded or not, if he can't receive anything to this IP? – rid May 11 '12 at 13:13
That, the attacker would know best. :) This is only a possible guess. – Bibhas May 11 '12 at 13:22
IP's are generally used to determine if traffic is spammy or bot-driven. by spoofing an IP the attacker can keep their true IP cleaner. – Dez May 11 '12 at 14:23
@Dez, that makes sense, but what I don't understand is how do they get the result of their work if they spoof their IP? Wouldn't the acknowledgment that the guessed password is correct go to the impossible IP and never reach the attacker? How do they know they successfully logged in? – rid May 11 '12 at 20:25
@Radu I'm not actually sure. inner-workings of network traffic isn't really my forte. – Dez May 11 '12 at 20:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.